Sharing National Security Letters with the Public

https://blog.google/topics/public-policy/sharing-national-security-letters-public/

by 0mp • 10 years ago

340 135 10 years ago

Has anyone on HN ever been notified by Google/Yahoo/other that they were the subject of an NSL? I wonder if the people most likely to care about that are unlikely to ever be targeted?

rhizome• 10 years ago

NSLs prohibit informing the target.

dewey• 10 years ago

"A Google spokesperson said the usernames were redacted to protect user privacy and that the targeted individuals had been notified."

CiPHPerCoder2• 10 years ago

Right. I meant one of the published NSLs where "the targeted individuals have been notified", not the unpublished ones.

swalsh• 10 years ago

Imagine the possibilities of this, combined with McCarthy's wet dream palantir.

plussed_reader• 10 years ago

You mean Trumps wet dream, Palantir? What a perfect vessel for public/private cooperative actions! I'm sure his buddy Pete would give him a huge referral.

indolering4• 10 years ago

I've had at least half-a-dozen non-techie friends signup for Signal since Trump's election.

whybroke• 10 years ago

...combined with McCarthy's wet dream...

His dreams really can come true:

http://mediamatters.org/video/2016/06/13/fox-s-gingrich-call...

secfirstmd2• 10 years ago

I wonder how this writing of a NSL letter would affect an organisation's warrant canary (if they have one).

kakarot2• 10 years ago

There's always blackmail, too. Plenty of ways to force a warrant canary to continue as normal

indolering4• 10 years ago

That's what an NSL is ... if you don't comply they throw you in jail. If you challenge a charge, the prosecutor will often add new ones.

secfirstmd2• 10 years ago

But how does that work with a distributed canary? An NSL may affect someone in the USA who is part of a canary but what if it has to be signed by someone in the UK, then Hong Kong, then Kenya, then Venezuela etc? Those people can't be compelled to sign it....

indolering4• 10 years ago

The US courts haven't decided on whether warrant canaries are constitutionally protected speech. At best, they help ward off an NSL as it would lead to a challenge that the EFF would love to take to the Supreme Court. The powers-that-be would much prefer to have some money laundering operation challenge a warrant canary.

cookiecaper• 10 years ago

I'm not a lawyer, but every time I've talked to one about this type of subject, they've informed me that these "clever" loopholes like warrant canaries are not viewed favorably by prosecutors or judges. They'll happily slap you with conspiracy/accessory/obstruction/contempt/whatever charges if they think you're being cute and trying to short-circuit a legal order with loopholes. Apparently the law, at least in most areas, has anticipated the existence of smartasses and provided mechanisms to deal with them.

I can't imagine that warrant canaries would be much different in practice. The judge would probably say that removing the canary is tantamount to revealing the existence of the letter, is thus a violation of the gag order, and that doing it will land you in contempt.

Again, pure speculation, and not a lawyer.

bradleyjg• 10 years ago

This is probably a better link: https://blog.google/topics/public-policy/sharing-national-se...

azurezyq• 10 years ago

I really think HN should block/downvote all TC links, which are most of the time worse than the original source.

gurneyHaleck• 10 years ago

No, that's a bad idea.

TC articles ARE many times vapid, uniformative and click-baity, but...

They will remain tech-oriented, timely and do serve the purpose of initiating conversation, by drawing attention to information sources that might not have gained visibility on their own. In short, you risk harming the network effect by applying a censor or restriction against such behavior.

This is one of those nuances that requires to blood and sweat of moderation. Unless there's a reasonable way to maybe crawl the submission and search its contents reliably, preventing such links carries risk.

CuriousCosmic• 10 years ago

I think instead they could possibly add a report button for links explicitly for providing the original source. To help limit people just bashing it for the hell of it, the report could be set up to only submit with a valid URL. Then the mods could quickly correct it.

lowglow• 10 years ago

The relationship between YC/HN and TC goes back pretty far as part of a collusory pipeline for media attention around startup launch and funding announcements. Not sure how that's changed since TC's decline over recent years (which is why I imagine YC invested in ProductHunt), but there are possibly still some artifacts of a relationship there that might prevent this.

dang• 10 years ago

Ok, we changed to that from https://techcrunch.com/2016/12/13/google-national-security-l....

gxs2• 10 years ago

It's interesting that most of these are only for:

>...name, address, length of service, and electronic communications transactional records for all services, as well as accounts...

Makes me think they would submit two requests: one for metadata and one for content. This would allow them to let google publish more "innocuous" letters while continue to gag order letters where they request more intrusive information.

Would love to hear the opinion, however, of someone who unlike myself knows what they are talking about.

londons_explore• 10 years ago

Multiple requests would also likley mean that if one were challenged in court, the other could still be fulfilled.

magicalist• 10 years ago

Makes me think they would submit two requests: one for metadata and one for content

NSLs can't (legally) be used for content, only metadata.

(putting aside, of course, that metadata is itself content)

gxs2• 10 years ago

Ah see, this is what I meant. This makes sense. Thanks for the clarification.

boomboomsubban• 10 years ago

I only looked at one of them, but it seems that these are able to be released as they have the same illegal language as the Internet Archive release. Their language makes it sound like they were released due to the government being forced to review if they should be upheld.

bahmboo• 10 years ago

From the statute (and in the letters):

the information sought is relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities, provided that such an investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution of the United States.

Of course they could still lie but you can't be investigated just for your protected speech. Not defending the whole thing, but didn't realize that requirement until now.

[edit: formatting]

sandworm1013• 10 years ago

> ... but you can't be investigated just for your protected speech.

Yes you can. All law enforcement regularly investigate wholly innocent people. It's called following leads. The vast majority of people investigated are totally innocent and never hear a peep. Sometimes those investigations lead to bad people, sometimes the lead was false, and sometimes they discover there is no real crime. They look at the speech, determine it is perfectly legal, and that's the end of the situation. But that is still "investigating".

dannypgh3• 10 years ago

It's not as simple as that.

"The price of lawful public dissent must not be a dread of subjection to an unchecked surveillance power. Nor must the fear of unauthorized official eavesdropping deter vigorous citizen dissent and discussion of Government action in private conversation." From https://en.wikipedia.org/wiki/United_States_v._United_States...

And "These Guidelines do not authorize investigating or collecting or maintaining information on United States persons solely for the purpose of monitoring activities protected by the First Amendment or the lawful exercise of other rights secured by the Constitution or laws of the United States" from the Attorney General's guidelines for the FBI, which were originally created because of said case.

Much as how there's a legal distinction between firing someone for no reason and firing someone for an illegal reason, there is certainly reasonably interpretable legal precedent that investigating someone solely for their protected first amendment activities may violate their first and fourth amendment rights.

Of course, IANAL, but that doesn't seem to stop many people on the internet.

anigbrowl2• 10 years ago

Interestingly, 'clandestine' doesn't seem to be defined in US law; Black's law dictionary defines it as 'secret or concealed, especially for illegal or unauthorized purposes.' The law does ban such activities conducted 'on behalf of a foreign power,' which latter definition is so wide in scope as to encompass all sorts of people who might never have considered themselves to be such.

https://www.law.cornell.edu/uscode/text/50/1801

Simply having too high a degree of curiosity about certain parties and gathering publicly available data could easily be made to qualify in the hands of a creative prosecutor (and I anticipate prosecutions getting a lot less rigorous and a lot more creative in many jurisdictions real soon now).

Of course they could still lie but you can't be investigated just for your protected speech.

I'm not sure that curating a lot of information - a private library, if you like - constitutes a speech act per se.

Suppose, for example, that I wished to dominate the market for some collectible item and assembled a large volume of information on the market and its participants, but chose not to publish or advertise its existence so as not to tip my hand to competitors in that collectors' market. I would, by definition, be engaged in a sort of clandestine intelligence activity - albeit a wholly harmless one. I'm really not sure if the collection of such information is protected by the 1A.

You'd think so, but I can think of many persuasive arguments to the contrary. There's no federal law explicitly protecting the privacy of journalistic sources, for example, so it's possible that the act of publication itself might be considered a prerequisite to a 1A defense. I hope I'm overthinking this but it does seem to be a bit of a legal hot potato.

https://en.wikipedia.org/wiki/Shield_laws_in_the_United_Stat...

mr_spothawk• 10 years ago

Over 300,000 NSLs have been issued in the past 10 years alone. The most NSLs issued in a single year was 56,507 in 2004. In 2013, President Obama’s Intelligence Review Group reported; that the government continues to issue an average of nearly 60 NSLs every day. By contrast, in 2000 (the year before the passage of the USA PATRIOT Act that loosened NSL standards), 8,500 NSLs were issued.

[https://www.eff.org/issues/national-security-letters/faq#5]

* - formatting

bogomipz2• 10 years ago

I am trying to imagine just how much the legal council alone for 300K NSLs a year costs the American Economy.

I would like to know what proportion of those 300K are tech companies.

Vintila• 10 years ago

I would also like to know the probability of indictment given an NSL.

ubernostrum• 10 years ago

A tip:

* Council is a group of people, often in charge of something.

* Counsel is an attorney (whose job is in part to advise you, like any other counselor).

kodablah• 10 years ago

Correction, ~30k a year. Still doesn't change your question much. I really hope the vast majority have their gag order removed. Who knows how many were sent to now defunct companies.

wheelerwj• 10 years ago

ahahaha, it's an email template at this point.

JorgeGT2• 10 years ago

Tangential: it always annoys me how difficult it is to highlight text in a Google blog post and look it up. Drag doesn't work and right click clears the selection. My only working approach is highlight and hit menu key.

ominous• 10 years ago

Firefox 50.0.2 (just noticed there's an update) on Windows 10.

    Drag to select, ctrl+c, ctrl+k, ctrl+v, enter.
    Drag to select, ctrl+c, ctrl+t, ctrl+v, enter.
    Drag to select, ctrl+c, ctrl+l, ctrl+v, enter.

working for me.

hashhar• 10 years ago

Also, right click on any term and hit "Search for <term> using <engine of choice>".

eriknstr4• 10 years ago

I was about to say that it worked fine for me but then I realized that it might be because I have uMatrix, so I allowed the site everything it wanted in order to test and indeed that interferes with right click due to a dumb black popup thing with a twitter and two other icons on it.

Disappointed. Would have expected more in terms of UX from Google.

Anyway you might enjoy uMatrix, it's pretty good although it can be a tad bit annoying to figure out what I need to allow each domain in order for their pages to load content when they host content-critical scripts and such on a separate CDN-domain that they own or through a third-party CDN.

I also don't know if it's possible to allow some domain to always be allowed to be iFramed by any other. For example I would like to always allow embeds from SoundCloud, YouTube and Vimeo on any site.

komali23• 10 years ago

I don't know why you'd expect better from UX, Google has had notoriously terrible UX for as long as I can remember. Off the top of my head - blogger/blogspot, youtube, hangouts android app, google voice android app, gmail settings, google maps (especially the android app), etc.

asquabventured3• 10 years ago

I also don't know if it's possible to allow some domain to always be allowed to be iFramed by any other. For example I would like to always allow embeds from SoundCloud, YouTube and Vimeo on any site.

You can do this with uMatrix (and have added this functionality to my own browsers for the sites you used as an example) To do the same, add the following rules to your 'My Rules' tab:

For SoundCloud:

  * sndcdn.com other allow
  * sndcdn.com script allow
  * sndcdn.com xhr allow
  * soundcloud.com frame allow
  * soundcloud.com image allow
  * soundcloud.com other allow
  * soundcloud.com script allow
  * soundcloud.com xhr allow

For YouTube:

  * youtube-nocookie.com frame allow
  * youtube-nocookie.com script allow
  * youtube-nocookie.com xhr allow
  * youtube.com frame allow
  * youtube.com image allow
  * youtube.com other allow
  * youtube.com plugin allow
  * youtube.com script allow
  * youtube.com xhr allow
  * ytimg.com image allow
  * ytimg.com plugin allow
  * ytimg.com script allow

For Vimeo:

  * vimeo.com frame allow
  * vimeo.com other allow
  * vimeo.com script allow
  * vimeo.com xhr allow
  * vimeocdn.com frame allow
  * vimeocdn.com other allow
  * vimeocdn.com plugin allow
  * vimeocdn.com script allow
  * vimeocdn.com xhr allow

You can also do a global wildcard that allows all types such as

  * soundcloud.com * allow

but I prefer the more granular approach to allowing each element type.

egwynn• 10 years ago

On macOS, you can three-finger-tap (not click, tap) to invoke the right-click “Look Up” menu item. That’s my preferred technique, though it’s obviously OS-dependant.

JorgeGT2• 10 years ago

I remember that I had a Synaptics driver on my old XPS laptop that allowed to customize three-fingers actions, so probably should be doable in other environments!

gambler• 10 years ago

And then some fronted developers wonder how/why anyone would browse the Web with JavaScript blocked. This is why. (Plus malware. Plus privacy. Plus performance issues.) Thankfully the blog renders without JS.

abritinthebay2• 10 years ago

Trust me: we know

espeed• 10 years ago

Click-drag to highlight, and then Alt-click to "Search Google" works for me on Chromebook.

bflesch• 10 years ago

They redacted the NSL letter number on the top left of the second pages, but kept the file reference number "In reply, please refer to NSL 10-272979" both in the address box on first page and the name of the PDF file.

christop• 10 years ago

Are you sure that's the NSL number being redacted at the top-left?

The NSL numbers are also listed in the Google blog entry, and are in the URLs of each PDF, so the numbers definitely aren't something that Google intended to censor.

pauleastlund• 10 years ago

awqrre• 10 years ago

I wish the FBI would be required to produce the original digital document instead of poor quality scans...

bogomipz2• 10 years ago

I agree. Is that intentional you think?

slig• 10 years ago

I'm guessing here that the original, even if redacted, can leak extra data that they don't intend to leak.

hobarrera• 10 years ago

The probably only move this copy around since most likely, they're actually hand-signed (rather than a pasted jpeg-signature).

timbowhite• 10 years ago

we have been freed of nondisclosure obligations.
the Act restricts the use of indefinite gag restrictions that prevent providers from ever notifying customers

Did Google say anywhere in that blog post that they've notified the users the NSLs were targeted at?

EDIT: no, but from the TC article[1]

A Google spokesperson said the usernames were redacted to protect user privacy and that the targeted individuals had been notified.

[1] https://techcrunch.com/2016/12/13/google-national-security-l...

haikuginger• 10 years ago

The fact that the NSL numbers are sequential gives an interesting look into the scale of issuance.

paganel• 10 years ago

I checked the article again after reading your comment and you were not kidding. Damn! I thought maybe they had learned something from the "German tank problem" (https://en.wikipedia.org/wiki/German_tank_problem), but maybe they just don't care how all this looks to us, regular people.

h4nkoslo• 10 years ago

The interesting aspect of NSLs to me has always been authentication. One gets a fax, and one faxes some crap back? Trivially hackable. One contacts the phone number listed on the NSL? Ditto. How difficult would it be for the Chinese or the Russians to slide in their own "NSL" in the 30K / year "legitimate" ones?

In fact the feds make it intentionally difficult to authenticate requests; for instance they prohibit taking copies of federal IDs, they often won't submit them for actual inspection, and they have no directory of employees to consult. If one wants to confirm that one is speaking to a bona fide FBI agent you're looking at minimum an hour in phone tag, and then there is the issue of if they are relating a bona fide request or going off the reservation.

mikiem2• 10 years ago

You can Google the phone number in the letter and also look up the number for the field office they are from, call the office and ask for the agent.

Yes, it may take time. But you don't get many NSLs, so you do it. You do it to protect yourself (liability of disclosing info without a legal order) and your customer/user who is the subject of the letter. Every time.

tehwalrus• 10 years ago

In 2015, Congress passed the USA Freedom Act

Really?! That is a terrible name for a piece of legislation - it says nothing - even before you consider that it was messing with gag orders about executive overreach.

throwaway199729• 10 years ago

Certain names are timeless favorites with bureaucrats (and worse):

"Freedom Act", "Freiheitsgesetz":

https://en.wikipedia.org/wiki/German_referendum,_1929

"Extraordinary rendition", "Sonderbehandlung":

https://en.wikipedia.org/wiki/Sonderbehandlung

mikiem2• 10 years ago

Interesting. As a service provider (hosting) we have received many "court orders" that are very similar to these NSLs... but they were not NSLs. Now that I see these NSLs, I am not that freaked out by them. I'm not sure of all the hub bub, at least for these particular NSLs. The scope of these is basically limited to identifying the user. These specifically say to not provide content of the account to the FBI. The not-NSL court orders we have received have included verbage to not disclose the request to the subject of the request.

I thought NSLs were supposedly non-contestible, broad and were for communication detail. These don't seem to be any if that.

The requests we have received have been from a variety of organizations (but signed by a magistrate) ranging from local law enforcement to three letter acronyms and one entity that is neither. While the requests don't say why the order is being issued, we usually receive a call from the agent/detective beforehand and dialog ensues in which they explain what's going on.

While many companies will just give the info, we scrutinize the request and ask the agent/detective politely and apologetically that we can help, but only if they acquire a court order. We have caught not-legitimate requests before, so we verify the request is legit before responding. We have never been asked for content of communications. If Google is not doing the same thing... oof. Just as a matter of process I assume they do. I recall in the past some networks having right in their WHOIS info, how/where Law Enforcement can send FAX requests.

Sharing National Security Letters with the Public

Related Stories